Skip to content
Fencer Vulns
high 7.5

CVE-2026-42583 json

Netty: Lz4FrameDecoder resource exhaustion

published 2026-05-07 6 mo ago modified 2026-10-26 13 d ago also GHSA-mj4r-2hfc-f8p6 , EUVD-2026-30126

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Patch / fix

  • maven io.netty:netty-codec-compression 4.2.13.Final
  • maven io.netty:netty-codec 4.1.133.Final
  • netty netty 4.1.133, 4.2.13
  • eap7-netty jboss enterprise application platform eus 7.1 4.1.63-4.Final_redhat_00005.1.ep7.el7
  • eap7-wildfly jboss enterprise application platform eus 7.1 7.1.16-1.GA_redhat_00002.1.ep7.el7
  • eap7-hibernate jboss enterprise application platform eus 7.1 5.1.17-5.Final_redhat_00006.1.ep7.el7
  • eap7-netty-all jboss enterprise application platform eus 7.1 4.1.63-4.Final_redhat_00005.1.ep7.el7
  • eap7-hibernate-core jboss enterprise application platform eus 7.1 5.1.17-5.Final_redhat_00006.1.ep7.el7
  • eap7-hibernate-java8 jboss enterprise application platform eus 7.1 5.1.17-5.Final_redhat_00006.1.ep7.el7
  • eap7-wildfly-modules jboss enterprise application platform eus 7.1 7.1.16-1.GA_redhat_00002.1.ep7.el7
  • eap7-hibernate-envers jboss enterprise application platform eus 7.1 5.1.17-5.Final_redhat_00006.1.ep7.el7

red hat advisories RHSA-2026:73976RHSA-2026:73644

  • netty-tcnative SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.0.77-150200.3.39.1
  • netty SLE Module for Package Hub 15 SP7 4.1.133-150200.4.46.1

suse advisories SUSE-SU-2026:2308-1

  • netty openSUSE Tumbleweed 4.1.133-1.1

opensuse advisories openSUSE-SU-2026:10795-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-42583 updated cvss 7.5

netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder

  • Red Hat OpenShift Serverless openshift-serverless-1/kn-ekb-receiver-rhel9, openshift-serverless-1/kn-ekb-dispatcher-rhel9, openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9, +4 more Red Hat build of Apache Camel - HawtIO 4 netty-codec-compression
    affected: workaround, no fix available
  • Red Hat build of Apicurio Registry 2 netty-codec
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 3 netty-codec
    affected: workaround, no fix available
  • Red Hat build of Debezium 3 netty-codec
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Build of Keycloak rhbk-rhel9-operator, rhbk/keycloak-rhel9, rhbk-openshift-rhel9, rhbk/keycloak-rhel9-operator
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat build of OptaPlanner 8 netty-codec
    affected: workaround, no fix available
  • Red Hat Fuse 7 netty-codec
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 8 netty-codec
    affected: workaround, no fix available
show 21 more
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel9, rhoai/odh-openvino-model-server-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/server-rhel9, devspaces/openvsx-rhel9, devspaces/pluginregistry-rhel9
    affected: workaround, no fix available
  • Red Hat Process Automation 7 netty-codec Red Hat Single Sign-On 7 netty-codec
    affected: workaround, no fix planned “Will not fix”
  • Red Hat streams for Apache Kafka 2 netty-codec
    affected: workaround, no fix available
  • Red Hat AMQ Clients 2026.Q3
    fixed: vendor fix RHSA-2026:69459
  • Red Hat AMQ Broker 7.14.1
    fixed: vendor fix RHSA-2026:66488
  • Red Hat build of Keycloak 26.4.13
    fixed: vendor fix RHSA-2026:30049
  • Red Hat Data Grid 8.6.2
    fixed: vendor fix RHSA-2026:41951
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.16-1.GA_redhat_00002.1.ep7.el7, eap7-netty 4.1.63-4.Final_redhat_00005.1.ep7.el7, eap7-hibernate 5.1.17-5.Final_redhat_00006.1.ep7.el7, eap7-netty-all 4.1.63-4.Final_redhat_00005.1.ep7.el7, eap7-wildfly-modules 7.1.16-1.GA_redhat_00002.1.ep7.el7, eap7-hibernate-core 5.1.17-5.Final_redhat_00006.1.ep7.el7, +4 more
    fixed: vendor fix RHSA-2026:73976
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.19-1.GA_redhat_00004.1.el7eap, eap7-netty 4.1.63-7.Final_redhat_00005.1.el7eap, eap7-hibernate 5.3.39-1.Final_redhat_00001.1.el7eap, eap7-netty-all 4.1.63-7.Final_redhat_00005.1.el7eap, eap7-wildfly-modules 7.3.19-1.GA_redhat_00004.1.el7eap, eap7-wildfly-javadocs 7.3.19-1.GA_redhat_00004.1.el7eap, +28 more
    fixed: vendor fix RHSA-2026:73644
  • Red Hat OpenShift AI 2.25 rhoai/odh-trustyai-service-rhel9 1788198681
    fixed: vendor fix RHSA-2026:65126
  • Red Hat OpenShift AI 3.4 rhoai/odh-trustyai-service-rhel9 1791792525
    fixed: vendor fix RHSA-2026:84734
  • Red Hat OpenShift Dev Spaces 3.29 devspaces/multicluster-redirector-rhel9 1782989027
    fixed: vendor fix RHSA-2026:36820
  • Red Hat Streams for Apache Kafka 2.9.4
    fixed: vendor fix RHSA-2026:34608
  • Red Hat Streams for Apache Kafka 3.2.1
    fixed: vendor fix RHSA-2026:54435
  • Red Hat Cryostat 4 netty-codec
    not affected: vulnerable code not present
  • Red Hat build of Apache Camel 4 for Quarkus 3 netty-codec
    not affected: inline mitigations already exist
  • Red Hat build of Apache Camel for Spring Boot 4 netty-codec Red Hat Build of Keycloak netty-codec Red Hat build of Quarkus netty-codec Red Hat Enterprise Linux AI (RHEL AI) 3 bazel6, bazel7, bazel8
    not affected: vulnerable code not present
  • Red Hat JBoss Enterprise Application Platform 7 netty-codec Red Hat JBoss Enterprise Application Platform Expansion Pack netty-codec, netty-codec-compression
    not affected: component not present
  • Red Hat Offline Knowledge Portal offline-knowledge-portal/rhokp-rhel9
    not affected: inline mitigations already exist
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel8, rhoai/odh-spark-operator-rhel9, rhoai/odh-trustyai-service-rhel8, rhoai/odh-th06-cpu-torch210-py312-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, rhoai/odh-th06-rocm64-torch291-py312-rhel9, +2 more Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1788331391, rhoai/odh-vllm-cpu-rhel9 1786712073, rhoai/odh-dashboard-rhel9 1788312226, rhoai/odh-modelmesh-rhel9 1788319539, rhoai/odh-operator-bundle 1788332816, rhoai/odh-vllm-cuda-rhel9 1786710989, +70 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1791509689, rhoai/odh-automl-rhel9 1791535789, rhoai/odh-mlflow-rhel9 1791865967, rhoai/odh-autorag-rhel9 1791557539, rhoai/odh-trainer-rhel9 1791869783, +99 more Red Hat OpenShift Dev Spaces 3.29 devspaces/udi-rhel9 1782991491, devspaces/code-rhel9 1782498475, devspaces/server-rhel9 1783033397, devspaces/openvsx-rhel9 1783007534, devspaces/traefik-rhel9 1782403274, devspaces/udi-base-rhel9 1782987705, +10 more Red Hat Satellite 6 candlepin, candlepin-selinux
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven io.netty:netty-codec-compression
<4.2.13.Final
4.2.13.Final
maven io.netty:netty-codec
<4.1.133.Final
4.1.133.Final

Affected products

  • netty netty
  • io.netty netty-codec
  • io.netty netty-codec-compression

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.